Currently, our bandit appsec include is expecting to use one of the python3-build images under docker-registry.wikimedia.org. But its apt calls aren't working now (example) because those images are now too locked down. So let's update the include (and the doc) to use a more generic bookworm (or similar) image.
Description
Description
Details
Details
| Title | Reference | Author | Source Branch | Dest Branch | |
|---|---|---|---|---|---|
| Refactor python bandit template | repos/security/gitlab-ci-security-templates!34 | sbassett | T360721-refactor-python-bandit-include | main |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | sbassett | T342177 [EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work | |||
| Open | sbassett | T360721 Update the image used by the python-bandit appsec include |
Event Timeline
Comment Actions
sbassett opened https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/34
Refactor python bandit template
Comment Actions
mmartorana merged https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/34
Refactor python bandit template
Comment Actions
Via the new appsec pipeline metrics cli (T342467), I was able to find that only a couple of repos are using the bandit include right now:
'wikimedia-code-health-check' ['repos/security/gitlab-ci-security-templates / main / /python-bandit/python-bandit-ci.yml'] 'ci-cd-testing-gitlab-ci-security-templates' ['repos/security/gitlab-ci-security-templates / main / generic-osv/osv-ci.yaml', 'repos/security/gitlab-ci-security-templates / main / golang-go-mod-outdated/go-mod-outdated-ci.yml', 'repos/security/gitlab-ci-security-templates / main / golang-gosec/golang-gosec-ci.yml', 'repos/security/gitlab-ci-security-templates / main / npm-outdated/npm-outdated-nodejs-ci.yml', 'repos/security/gitlab-ci-security-templates / main / php-composer-outdated/php-composer-outdated-ci.yml', 'repos/security/gitlab-ci-security-templates / main / php-phan-taint-check/php-phan-taint-check-ci.yml', 'repos/security/gitlab-ci-security-templates / main / php-security-checker/php-security-checker-ci.yml', 'repos/security/gitlab-ci-security-templates / main / python-bandit/python-bandit-ci.yml', 'repos/security/gitlab-ci-security-templates / main / secret-seeker/seeking-secrets.yaml', 'repos/security/gitlab-ci-security-templates / main / semgrep/semgrep-ci.yml']